ChainScript: Node.js RAT Hides Command Server in Blockchain Contract

Researchers at Blackpoint have discovered a Node.js remote access trojan (RAT) called ChainScript that uses a Polygon smart contract to find and rotate its command server. This technique, known as EtherHiding, allows attackers to update the server address without modifying the malware itself.

The infection starts with a ClickFix trick, where victims are persuaded to paste and run a command that downloads an installer disguised as Spotify. The installer contains a full Node.js runtime and a JavaScript agent that launches once installed. None of this requires admin rights, as the installer runs within the user's profile.

ChainScript finds its command server by querying a smart contract on the Polygon blockchain, which returns a string starting with ws:// or wss://. The malware saves this address for five minutes and uses it to connect to the attackers' server. If the attackers want to change servers, they only need to update the smart contract.

Once connected, ChainScript provides operators with a full interactive shell, file read and write access, desktop screenshots, the ability to push additional payloads, a scan for installed crypto wallets, arbitrary JavaScript execution, and a self-update function. However, it does not steal seed phrases or private keys from wallets.